Since the question over Linux's pedigree first erupted earlier this year, companies that use Linux have managed to stay out of court. But SCO Group, which is pressing a $3 billion intellectual-property lawsuit against IBM, continues to hold out the possibility that Linux users could be held liable, too. The threat has caused some to throttle back deployment of the open-source operating system.

Hewlett-Packard last week moved to shield businesses from that concern by offering to indemnify its customers against potential SCO Group lawsuits. The decision is notable not only because HP becomes the first major Linux distributor to offer such protection, but also because it's doing so without having signed any new licensing agreements with SCO Group. HP, in essence, is challenging SCO Group to show its hand.

"I find it interesting that HP said that they have no Linux-specific agreements and have not paid SCO anything for that indemnification," Linux creator Linus Torvalds wrote last week in an E-mail to InformationWeek. "To me, it says HP isn't too worried about the validity of any SCO lawsuits." Torvalds co-manages development of Linux at the Open Source Development Lab, an industry consortium that includes Cisco Systems, Dell, IBM, and Intel.

At the root of the controversy is SCO Group's allegation that IBM programmers and other open-source developers illegally contributed Unix System V source code to the Linux kernel. IBM and Linux distributor Red Hat Inc. dispute the claim and maintain that indemnity protection isn't necessary for customers. Their tack: countersuits. IBM last week sued SCO Group in District Court in Salt Lake City, charging the smaller company with "misusing its purported rights" to Unix and patent infringement. Red Hat sued SCO Group in August for making "unsubstantiated and untrue" statements about open-source development.

Despite such moves, the threat of legal action from SCO Group hangs like a cloud over Linux adopters (see "Worried Yet?" June 23, p. 20). In a survey of 400 business-technology professionals completed earlier this month by InformationWeek Research, 28% of respondents cite "potential intellectual-property issues" as a concern in using Linux and open source.

HP's offer to protect companies that sign a Linux support contract was welcomed by some, including companies that don't get their Linux from HP. "It's a great thing. There's no downside," says Scott Hicar, CIO of disk-drive manufacturer Maxtor Corp., which uses Linux for a few applications. Hicar says he would like to see other Linux vendors follow suit.

Aberdeen Group analyst Bill Claybrook says such protection should be part of doing business. "If a company sells you software, they should stand behind it, even if it's not their software," Claybrook says.

Supermarket chain Giant Eagle Inc. is using Red Hat Linux on Compaq ProLiant servers. CIO and senior VP of information services Russ Ross says he's not concerned about SCO Group targeting his company, and he expects Red Hat to stand behind its product. "With any product purchase, I would expect whoever we bought it from to hold us harmless," Ross says.

SCO Group in May put businesses on notice when it sent letters to 1,500 companies, warning that using Linux could violate SCO's intellectual-property rights. It hasn't backed down from that warning. In fact, earlier this month, SCO Group president and CEO Darl McBride charged that more than 1 million lines of Unix code have been improperly moved into Linux. SCO Group is offering to let businesses off the hook if they sign one of its newly crafted Linux licenses. Until Oct. 15, the licenses cost $699 per CPU; after that, the cost doubles. While it's common for makers of proprietary software to protect customers from intellectual-property infringement claims, such protection hasn't been offered with open source because the software's lineage isn't as clear cut, says Melise Blakeslee, a partner with law firm McDermott, Will & Emery. With open source, she says, users are getting the software "as is." HP's offer to take responsibility for any SCO Group claims will likely reassure customers, Blakeslee says.

HP's approach stands in contrast to IBM's legal maneuvers. "It seems pretty clear that if you run Linux on HP and don't change the source code, HP will protect you," Aberdeen analyst Claybrook says. Under the deal, HP requires that customers make no modifications to Linux. Martin Fink, HP's VP of Linux, asserts that most customers don't do that anyway.

In a memo to his staff obtained by InformationWeek, Bob Samson, IBM's VP for systems sales, said an indemnification policy could prevent users from fully exploiting Linux. "Most indemnities are narrowly drawn and are often invalidated by customer activities, such as making modifications," Samson wrote. IBM says it would prefer to resolve the matter in the courts.

Some analysts say IBM is merely attempting to discredit HP's indemnification policy because it's not in a position to offer users the same protection. "They are a party to the lawsuit, so they can't indemnify," says Rob Enderle of the Enderle Group.

Linux distributor SuSE Inc. applauds HP's actions--but has no plans to emulate them. "HP is saying to SCO that if you're coming after our customers, you're going to have to come through us," a spokesman says.

Both Red Hat and SuSE say SCO Group's lawsuit against IBM and its attempts to charge Linux users a licensing fee have created some apprehension in the market. "We're seeing sales cycles lengthening a bit," says the SuSE spokesman. "A lot of this has to do with bringing in the legal team to make a risk assessment."

HP claims its business hasn't suffered and says its motivation is to reinstill confidence in Linux. "This fits into our desire to take accountability for end-to-end Linux solutions," Fink says. "If we're going to do this, we have to address SCO."

HP's promise to protect its Linux customers from SCO Group seems like a step in the right direction, but it's not clear that the promise would be bulletproof if ever challenged in court. An SCO Group spokesman says that HP customers "aren't being fully protected" even with HP's offer--other developers could theoretically claim intellectual-property rights as SCO has done. In the newly litigious world of operating-system source code, it seems, even a promise of protection is no guarantee of safety.

-- with John Foley and Paul McDougall

Photo by Charles Gullung/Photonica